Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

H Mmer/Correlate — measured AI agent skill | DecimalAI

h-mmer/correlate

NewSkillScoreMaintained

Run the finding correlation engine to discover attack chains from individual findings.

by h-mmer

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

decimalai skills pull h-mmer-correlate

Get this skill — curl · raw file

curl -fsSL https://app.decimal.ai/s/h-mmer-correlate/SKILL.md

Raw file: /s/h-mmer-correlate/SKILL.md ↗ · machine-readable summary at /s/h-mmer-correlate.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 7d ago

—+7% tokens0% turns45% of whole cases pass with skill (10/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-10	✗→✓	▲ Improved	24%	0%
case-13	✗→✓	▲ Improved	68%	0%
case-20	✗→✓	▲ Improved	-57%	0%
case-14	✓→✗	▼ Worse	-78%	0%
case-12	✓→✗	▼ Worse	-73%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/1/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

H-mmer / pentest-agents

providers/codex/.agents/skills/correlate/SKILL.md

View on GitHub ↗

Imported 8/1/2026Version v1

Skill contents

SKILL.md

Find attack chains by correlating all known findings.

uv run python3 ../../tools/statusline.py --compact — show current state
Launch correlator agent: "Analyze ALL findings in brain and findings.json. Find attack chains where one finding enables another. Document each chain with combined CVSS 4.0 and end-to-end reproduction steps."
After agent returns, update brain with discovered chains.
Show the user any new high-impact chains found.

Top-Tier Correlation Bar

Build a capability graph, not a list of related bugs.

Nodes are capabilities: read tenant data, write config, trigger webhook, steal token, reach internal host, execute workflow.
Edges require evidence that one capability enables the next. Shared component or same endpoint family is only a hint.
Score each chain by final impact, proof reliability, policy safety, duplicate risk, and report clarity.
Prefer chains that convert low-severity feeders into account takeover, tenant escape, stored XSS with privileged action, SSRF to credential disclosure, or config write to execution.
Record killed chains too. The next correlation pass should know which attractive edges failed and why.

Want to see if h-mmer/correlate would activate on your phrasing? Try it before you install — no LLM call, no signup.

Other measured skills in the registry, with their headline benchmark lift.